esc_attr on get_post_meta [closed]

Question

Simple question,

I see that some themes are using esc_attr or esc_html and url after they define varible with get_post_meta, while others are using it during variable definition. What would be best practice

1.

$portf_icon = get_post_meta($post->ID,'dt_portf_icon',true);    
echo esc_html($portf_icon);

or

$portf_icon = esc_html(get_post_meta($post->ID,'dt_portf_icon',true));
echo $portf_icon;

Does it have any difference and which one would be best practices?

Answer 1

The best practice in the WordPress world is to "escape late" i.e. at the point of output. While the two examples are effectively the same, the first one would be more effective if that code is ever refactored and the value of $portf_icon changes between where it's first assigned & where it's output.

This is especially important on WordPress VIP, and their documented coding standards includes a section on escaping late.