crowdfavorite/wp-social — comment on commit 4473280b5f9b9b96173aa547f07f8e1a3a122bc5
File: views/comment/comment.php line 35
By ziz:

From 2009: https://groups.google.com/group/wp-hackers/browse_thread/thread/8f1466febb168935/04ca736764e33840 indicates that escaping translated strings was common enough that the new esc_*__ calls were added to reduce nesting and complexity.

This is a more complicated situation, though, since you're translating two different strings - the time difference (`human_time_diff` sanitizes input and i18ns output) and the "%s ago" string which expects to modify a time difference to a relative time, and _then_ the escaping question comes into play. My recommended order for the functionality as written would in fact be as it originally was (but with sprintf, not printf):

~~~
comment_date_gmt)))); ?>
~~~

to escape the final string ("4 hours ago", after separately translating "%s ago" and the relative time and then combining them.

As far as "should we escape or not" - I agree that it is probably not generally necessary in an HTML content block. If the translated string is being used situations where the escaping rules may be different, it needs to be escaped as an encoding step rather than a protection step. (Situations such as an element attribute, a javascript string, in a URL, et cetera.)

My practice in the past and what I understand to be the usual best practice is to decide and assume that the translated strings will be already escaped to the same standard that your original strings are - that is, sufficiently for where they are being used.