I have code like this:
<?php echo '<div class="class-name">' . __( 'Text','text-domain' ) . '</div>'; ?>
in a plugin of mine.
Do i have to escape this? (esc_html or similiar)?
The answer typically depends on where your translations come from. WordPress core doesn't usually escape strings such as this, but you may wish to do so in your plugin.
In addition, using escaping functions around strings such as this means your code will pass the WordPress Code Standards sniffers.
No. There is no user supplied data in that string. You only have to escape user supplied data. The only why this could be hacked would be if someone managed to push something nasty through the
__() function but that would mean a server level hack, if possible at all, and if that were the case no escaping is going to fix anything. With that kind of hack, the attacker can do virtually anything.