These values should be validated in some way. I believe django does some automatic DB sanitation of strings passed to the ORM, but I wouldn't trust only that, and it'd be a lot better to avoid sending invalid queries to the DB.