Navigation script and template Overview:

I'm using the following page template and scripts for navigation. I use a single page that loads menus and context content, and then use ajax or GET variable to load main-div's content, by passing $p variable to a php switch. Browser history is handled whith pushState function.

Main page:

&lt;!DOCTYPE html&gt;
&lt;html&gt;
  &lt;head&gt;
  &lt;/head&gt;
  &lt;body&gt;
    &lt;div id="main-div"&gt; 
&lt;?php

if (isset($_GET['p'])) {
    $p = $_GET['p'];

} else {
    $p = "main";
}


require_once("assets/switch.php");

?&gt;
    &lt;/div&gt;

    &lt;script&gt;      
    // Define state on first load
    function defineState() {
            "use strict";
            window.history.replaceState("&lt;?php echo $p ?&gt;", "", "");
        }   
    window.onload = defineState;


    function navegacion(dashboard, history) {

       "use strict";
       var urlPath = dashboard;
       var xmlhttp;
       var ActiveXObject;

       if (window.XMLHttpRequest) {
           // code for IE7+, Firefox, Chrome, Opera, Safari
           xmlhttp = new XMLHttpRequest();
       } else {
           // code for IE6, IE5
           xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
       }
       xmlhttp.onreadystatechange = function() {
           if (xmlhttp.readyState === 4 &amp;&amp; xmlhttp.status === 200) {

                window.scrollTo(0, 0);

                //document.title = "TITLE";

                document.getElementById("main-div").innerHTML = xmlhttp.responseText;

                if(history !== 1) {
                    window.history.pushState(dashboard, "", "index.php?p="+urlPath);
                }

           }
       };
       xmlhttp.open("POST","assets/ajaxapi.php", true);
       xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");
       xmlhttp.send("dashboard="+dashboard);

    }

    // Allows for back and forward browswe buttons

    window.onpopstate = function(e){
    "use strict";
    if(e.state){
        navegacion(e.state, 1);
    }
    };  


    &lt;/script&gt;

  &lt;/body&gt;
&lt;/html&gt;


ajaxapi.php:

&lt;?php
if (isset($_POST['dashboard'])) {
    $p = $_POST['dashboard'];

} else {
    $p = NULL;
}

require_once("./switch.php");


Could there be any performance or error issues with this code, or how could this script be enhanced?

Thanks.
Security: XSS

You are open to reflected XSS via this payload:

p=foo","","");alert(1)//


Note that the injection takes place into a JavaScript context, which is worse than injections into HTML context because browser filters have a hard time catching it (if you try the payload with eg chrome, it will execute, while "&lt;/script&gt;&lt;script&gt;alert(1)&lt;/script&gt; would not).

Standard HTML-encoding would solve your problem, but OWASP recommends escaping to prevent XSS in a JS context.

Misc


p isn't a great variable name. If it stands for page, just use $page instead (also for the GET index).
As your other variable and function names are in english, navegacion should be as well.