Encoding complex objects is just hard (in the sense that it's going to get ugly, complicated, and usually both); however, just getting framing right (i.e. ensuring that client and server agree on where messages/objects start and end) at least solves many security problems. A simple binary (tag-)length-value works, as do schemes based on http://cr.yp.to/proto/netstrings.txt.