Index: wp-admin/edit-form-ajax-cat.php
===================================================================
--- wp-admin/edit-form-ajax-cat.php	(revision 2799)
+++ wp-admin/edit-form-ajax-cat.php	(working copy)
@@ -12,10 +12,13 @@
 	$new_cat_id = func_get_arg(0);
 }
 
+function get_out_now() { exit; }
+
 add_action('edit_category', 'grab_id');
 add_action('create_category', 'grab_id');
+add_action('shutdown', 'get_out_now', -1);
 
-$cat_name = stripslashes($_GET['ajaxnewcat']);
+$cat_name = rawurldecode($_GET['ajaxnewcat']);
 
 if ( !$category_nicename = sanitize_title($cat_name) )
 	die('0');
@@ -25,5 +28,5 @@
 $cat_name = $wpdb->escape($cat_name);
 $cat_array = compact('cat_name', 'category_nicename');
 wp_insert_category($cat_array);
-echo $new_cat_id;
-?>
\ No newline at end of file
+die($new_cat_id);
+?>
Index: wp-admin/admin-header.php
===================================================================
--- wp-admin/admin-header.php	(revision 2799)
+++ wp-admin/admin-header.php	(working copy)
@@ -118,13 +118,13 @@
 	newcat.id = 'newcat';
 	newcat.size = '16';
 	newcat.setAttribute('autocomplete', 'off');
-	newcat.setAttribute('onkeypress', 'return ajaxNewCatKeyPress(event);');
+	newcat.onkeypress = ajaxNewCatKeyPress;
 
 	var newcatSub = document.createElement('input');
 	newcatSub.type = 'button';
 	newcatSub.name = 'Button';
 	newcatSub.value = '+';
-	newcatSub.setAttribute('onclick', 'ajaxNewCat();');
+	newcatSub.onclick = ajaxNewCat;
 
 	ajaxcat.appendChild(newcat);
 	ajaxcat.appendChild(newcatSub);
@@ -160,7 +160,7 @@
 
 function newCatCompletion() {
 	var p = getResponseElement();
-	var id = ajaxCat.response;
+	var id = parseInt(ajaxCat.response, 10);
 	if ( id == '-1' ) {
 		p.innerHTML = "You don't have permission to do that.";
 		return;
@@ -172,32 +172,38 @@
 	p.parentNode.removeChild(p);
 	var exists = document.getElementById('category-' + id);
 	if (exists) {
+		var moveIt = exists.parentNode;
+		var container = moveIt.parentNode;
+		container.removeChild(moveIt);
+		container.insertBefore(moveIt, container.firstChild);
+		moveIt.id = 'new-category-' + id;
 		exists.checked = 'checked';
-		exists.parentNode.setAttribute('id', 'new-category-' + id);
-		var nowClass = exists.parentNode.getAttribute('class');
-		exists.parentNode.setAttribute('class', nowClass + ' fade');
+		var nowClass = moveIt.className;
+		moveIt.className = nowClass + ' fade';
 		Fat.fade_all();
-		exists.parentNode.setAttribute('class', nowClass);
+		moveIt.className = nowClass;
 	} else {
 		var catDiv = document.getElementById('categorychecklist');
 		var newLabel = document.createElement('label');
-		catDiv.insertBefore(newLabel, catDiv.firstChild);
 		newLabel.setAttribute('for', 'category-' + id);
-		newLabel.setAttribute('id', 'new-category-' + id);
-		newLabel.setAttribute('class', 'selectit fade');
+		newLabel.id = 'new-category-' + id;
+		newLabel.className = 'selectit fade';
 
 		var newCheck = document.createElement('input');
-		newLabel.appendChild(newCheck);
+		newCheck.type = 'checkbox';
 		newCheck.value = id;
-		newCheck.type = 'checkbox';
-		newCheck.checked = 'checked';
 		newCheck.name = 'post_category[]';
 		newCheck.id = 'category-' + id;
+		newLabel.appendChild(newCheck);
 
 		var newLabelText = document.createTextNode(' ' + newcat.value);
 		newLabel.appendChild(newLabelText);
+
+		catDiv.insertBefore(newLabel, catDiv.firstChild);
+		newCheck.checked = 'checked';
+
 		Fat.fade_all();
-		newLabel.setAttribute('class', 'selectit');
+		newLabel.className = 'selectit';
 	}
 	newcat.value = '';
 }
@@ -220,7 +226,7 @@
 
 function ajaxNewCat() {
 	var newcat = document.getElementById('newcat');
-	var catString = 'ajaxnewcat=' + newcat.value;
+	var catString = 'ajaxnewcat=' + encodeURIComponent(newcat.value);
 	ajaxCat.requestFile = 'edit-form-ajax-cat.php';
 	ajaxCat.method = 'GET';
 	ajaxCat.onLoading = newCatLoading;