Someone else may be able to shed more light on this and correct me (please do!) but thats my concern and would love to hear if it was a valid one or not.
Can you just do the same thing with JSON, Yaml, or your favorite serialization method of choice that does not have catastrophic consequences if parsing gets subverted?
Sure. You can even extend the `json` module to serialize custom data types not defined in the JSON spec.
This snippet is really helpful: http://www.djangosnippets.org/snippets/513/
One may think that if only the internal model of the user input is pickled, and the user only gets to update this internal model through web requests in defined ways, thus never getting to upload pickles or construct arbitrary complicated python objects, it should be relatively safe.
However, what remains is that if someone manages to blindly inject SQL, he can inject executable code into your application, instead of just injecting data.
When you upvote and need to sign in, the code to execute the upvote is stored to be executed once you sign in.