SQL delete query

[ZiNgA BuRgA]

You want to pass along as little information as possible in parameters.
Why do you need to pass the table name, for example?
Your table should have an ID (and this should be set as the primary key) - you should need to pass all that other crap along, only the ID of the row should be required.

As for protecting against people directly visiting the URL, it depends on how you're actually authenticating users.  Ideally the delete script should check whether the current user has permissions to perform the action.