providing CatigoryID and ProductID are stored as (int) in your db, there is nothing wrong with this. though you dont need to escape out of the string while your using double quotes. so this could be simplified to;
$result = mysql_query("SELECT * FROM products WHERE ProductID=$filter AND CategoryID=$CategoryID");
where are the variables $filter and $CatigoryID comming from though? if they come from a form, you should be referencing them using the $_POST array.
eg;
$filter = $_POST['filter'];
$CatigoryID = $_POST['CatigoryID'];
$result = mysql_query("SELECT * FROM products WHERE ProductID=$filter AND CategoryID=$CategoryID");