Django has you covered here.
Never ever insert raw user input into your SQL queries. Always use query parameters, and Django makes this very easy:
User.objects.filter(username=username)  # Dangerous!

User.objects.filter(username=username)  # Safe, username is a parameter

So in your view:
User.objects.get(username=request.POST['username'])  # Dangerous
User.objects.get(username=request.POST.get('username'))  # Safe

Django will automatically escape the username and use it as a parameter in the SQL query, making it safe.
So in short: Always let Django construct the SQL query, and never insert raw user input. As long as you do that, you'll be safe from SQL injection.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence