More info: http://richtabor.com/themeforest-tips/

escaping-translation-strings.php

<?php 
// These are incorrect:
__( 'Some String', 'text-domain' ); _e( 'Some string', 'text-domain' );

// Instead, use:
esc_html__( 'Some String', 'text-domain' ); esc_html_e( 'Some String', 'text-domain' );

/**
 * For strings with necessary HTML, use the following:
 * Note that I'm only including the actual allowed HTML for this specific string.
 * More info: https://codex.wordpress.org/Function_Reference/wp_kses
 */
$allowed_html_array = array(
    'a' => array(
        'href' => array(),
    ),
    'span' => array(
        'class' => array(),
    )
);

wp_kses( __( '<span class="powered-by"><a href="https://wordpress.org/">Proudly Powered by WordPress</a></span>', 'text-domain' ), $allowed_html_array );