Navigation script and template
Security: XSS

You are open to reflected XSS via this payload:

p=foo","","");alert(1)//


Note that the injection takes place into a JavaScript context, which is worse than injections into HTML context because browser filters have a hard time catching it (if you try the payload with eg chrome, it will execute, while "&lt;/script&gt;&lt;script&gt;alert(1)&lt;/script&gt; would not).

Standard HTML-encoding would solve your problem, but OWASP recommends escaping to prevent XSS in a JS context.

Misc


p isn't a great variable name. If it stands for page, just use $page instead (also for the GET index).
As your other variable and function names are in english, navegacion should be as well.