No, I'm just serializing dicts. Any user input is already in a string, so sanitized. I also usually make helper functions to get/set things in the dict, so I don't operate on the field outside the model often.

This snippet is really helpful: http://www.djangosnippets.org/snippets/513/