In a lot of how to create a custom meta box tutorials, when saving data, i.e., update_post_meta the data is escaped:
update_post_meta( $post_id, 'city', esc_attr( ucwords( $_POST['city'] ) ) );
Some tutorials do not esc when saving and do it on screen output.
However, escaping protects the output to the screen, i.e., echo:
echo esc_attr( $city );
So does it matter if you esc before you output to the screen or before it's saved?
If you esc on save does the order of esc-ing, sanitizing and validating matter?
Do you esc then sanitize and validate or sanitize, esc and sanitize . . . etc.?