In a lot of how to create a custom meta box tutorials, when saving data, i.e., update\_post\_meta the data is escaped:

```
update_post_meta( $post_id, 'city', esc_attr( ucwords( $_POST['city'] ) ) ); 

```

Some tutorials do not esc when saving and do it on screen output.

However, escaping protects the output to the screen, i.e., echo:

```
echo esc_attr( $city );

```

So does it matter if you esc before you output to the screen or before it's saved?

If you esc on save does the order of esc-ing, sanitizing and validating matter?

Do you esc then sanitize and validate or sanitize, esc and sanitize . . . etc.?