class AuthUser(AbstractBaseUser, PermissionsMixin):
    ...
    username = models.CharField(unique=True, max_length=11, validators=[alphanumeric])
    ...
def __str__(self):
        return '%s %s %s' % (self.last_name, self.first_name, self.second_name)

class Tovar(models.Model):
    tovar_name = models.CharField(max_length=20, unique=True)
    tovar_kol = models.IntegerField(default=0)  # кол-во
    tovar_prod = models.IntegerField(default=0) # кол-во покупок
    tovar_img = models.ImageField(upload_to='img/tovar', blank=False, default='img/tovar/tovar.jpg')
    def __str__(self):
        return self.tovar_name

class Zakaz(models.Model):
    zakaz_nomer = models.IntegerField(default=0, blank=True, null=True)
    zakaz_status = models.IntegerField(default=0, blank=True, null=True) # 1 - work , 2 - close , 3 - denied
    zakaz_tovar = models.ForeignKey(Tovar, blank=True, null=True)
    zakaz_kol = models.IntegerField(default=0, blank=False, null=False)
    zakaz_user = models.ForeignKey(AuthUser, blank=True, null=True)
    zakaz_time = models.DateTimeField(default=timezone.now())
    zakaz_comment = models.CharField(blank=True, null=True, max_length=300)

    def __str__(self):
        return '%s %s' % (self.zakaz_tovar, self.zakaz_user)

def try_buy(request, tovar_id=1):
    args = {}
    args['me'] = request.user.username
    args['form'] = ZakazForm()
    args['tovar'] = Tovar.objects.get(id=tovar_id)
    tov = Tovar.objects.get(id=tovar_id)
    args['zakaz_name'] = tov.tovar_name
    args['zakaz_user'] = request.user.username    
    return render_to_response('try_buy.html', args, context_instance=RequestContext(request))

...
 <form action="/examp/buy/" method="post">{% csrf_token %}
<textarea rows="1" name="zakaz_user" readonly>{{ zakaz_user }}</textarea>
<textarea rows="1" name="zakaz_tovar" readonly>{{ zakaz_name }}</textarea>
{{ form.zakaz_kol }}
{{ form.zakaz_comment }}
...

class ZakazForm(forms.ModelForm):
    class Meta():
        model = Zakaz
        fields = ['zakaz_tovar', 'zakaz_user', 'zakaz_comment', 'zakaz_kol', 'zakaz_tovar']
        widgets = {
            'zakaz_comment': Textarea(attrs={'cols': 50, 'rows': 20}),
        }

def catalog_buy(request):
    args = {}
    args.update(csrf(request))
    args['form'] = ZakazForm()
    args['me'] = request.user.username
    if request.method == 'POST' and ("pause" not in request.session):
        zakaz_tovar = request.POST.get('zakaz_tovar', '')
        zakaz_user = request.POST.get('zakaz_user', '')        
        form = ZakazForm(request.POST)
        if form.is_valid():            
            form.zakaz_tovar = zakaz_tovar
            form.zakaz_user = zakaz_user            
            form.save()
            request.session.set_expiry(30)
            request.session['pause'] = True
            args['kat_done'] = 1
            id_schetpre = Zakaz.objects.order_by('-zakaz_nomer')[0]
            id_schet = Zakaz.objects.order_by('zakaz_nomer')[0]
            if id_schetpre.zakaz_nomer >= 0:
                id_schet.zakaz_nomer = id_schetpre.zakaz_nomer
                id_schet.zakaz_nomer += 1
                id_schet.zakaz_status = 1
                id_schet.save()
                id_schetdone = Zakaz.objects.order_by('-zakaz_nomer')[0]
                args['ur_zakaz_nomer'] = id_schetdone.zakaz_nomer
                id_schetdone.zakaz_status = 1
                return render_to_response('try_buy.html', args, context_instance=RequestContext(request))
            else:
                redirect("/")
        else:
            args['kat_error1'] = "Заполните поля верно!"
            return render_to_response('try_buy.html', args, context_instance=RequestContext(request))
    else:
        args['kat_error2'] = "Покупки можно совершать 1 раз в 30 секунд!"
        return render_to_response('try_buy.html', args, context_instance=RequestContext(request))

if form.is_valid():            
    instance = form.save(commit=False)
    instance.zakaz_tovar = zakaz_tovar 
    instance.zakaz_user = zakaz_user 
    instance.save()

zakaz_tovar = request.POST.get('zakaz_tovar', '')
zakaz_user = request.POST.get('zakaz_user', '')