Just so you know, there's an error in your javascript that prevents you from deleting the "cat's" category. You need to escape that apostrophe....
in place of addslashes, you can just use [man]mysql_real_escape_string/man to properly escape characters. It's much better than addslashes since it won't hinder your parsing of data and it looks normal in the database, instead of something like \\\\\'s....
Well, you can use type-casting to keep IDs as integers and descriptions as strings if you wanted. Would be much more secure. At the same time, you can have an array of "allowed" values for you _GET variables. If it's not in the array, it could be a hacking attempt (or you forgot to add it to the array).
Those are just a few items... not to mention putting this whole functionality behind an authentication system.
