When both a query string and anchor tag (hash tag) are visible in a URL, what is the proper order for them to appear?
http://www.whatever.com?var=val#anchor
If intention of using # is to denote page fragment then - yes ? then #.
If # is coming before ? and it is not to denote page fragment (this can happen when # is part of authority (username and password)) it has to be encoded or you are in trouble. Same applies to any other special characters (:,@,...) that could give different meaning to url.