How to correctly escape data

You might want to check out WordPress official docs on this topic, in your case focus on escaping output https://codex.wordpress.org/Validating_Sanitizing_and_Escaping_User_Data