Scusa per prima non avevo visto la dichiarazione
di var globale cq ti conviene fare una cosa del genere
Codice PHP:
<html>
    <head>
        <title>The Hello World of AJAX</title>
        <script language="JavaScript" type="text/javascript">
            //Gets the browser specific XmlHttpRequest Object
            function getXmlHttpRequestObject() {
                if (window.XMLHttpRequest) {
                    return new XMLHttpRequest(); //Not IE
                } else if(window.ActiveXObject) {
                    return new ActiveXObject("Microsoft.XMLHTTP"); //IE
                } else {
                    //Display your error message here. 
                    //and inform the user they might want to upgrade
                    //their browser.
                    alert("Your browser doesn't support the XmlHttpRequest object.  Better upgrade to Firefox.");
                }
            }            
            //Get our browser specific XmlHttpRequest object.
///////////////////////////////////
////////////////// L'OBJECT DI TIPO XMLHttpRequest la dichiari globale qui
///////////////////////////////////
            var receiveReq = getXmlHttpRequestObject();        
            //Initiate the asyncronous request.
            function sayHello() {
                //If our XmlHttpRequest object is not in the middle of a request, start the new asyncronous call.
                if (receiveReq.readyState == 4 || receiveReq.readyState == 0) {
                    //Setup the connection as a GET call to SayHello.html.
                    //True explicity sets the request to asyncronous (default).
                    receiveReq.open('GET', 'SayHello.html', true);
                    //Set the function that will be called when the XmlHttpRequest objects state changes.
                    receiveReq.onreadystatechange = handleSayHello; 
                    //Make the actual request.

                    receiveReq.send(null);
alert(receiveReq.responseText);
//alert(receiveReq.getAllResponseHeaders());
                }            
            }
            //Called every time our XmlHttpRequest objects state changes.
            function handleSayHello() {
                //Check to see if the XmlHttpRequests state is finished.
                if (receiveReq.readyState == 4) {
                    //Set the contents of our span element to the result of the asyncronous call.
                    document.getElementById('span_result').innerHTML = receiveReq.responseText;
                }
            }
window.onload = function()
{
    if (document.addEventListener) 
    { 
        document.getElementById('pi').addEventListener('click',sayHello , false); 
    } 
    else 
    { 
        document.getElementById('pi').attachEvent('onclick', sayHello); 
    } 
}
            </script>
    </head>
    <body>
        
        [url="#"]Say Hello[/url]

        
        <span id="span_result"></span>
    </body>
</html> 
Per

eport_ordini2.asp?ordine=396&x=12&y=6
Usa la function escape come riportato in questo articolo