Escaping data in views

Hi, i have a few questions regarding escaping data and filtering data, because i am new in security issues and i want to prevent xss attacks and sql injections.

I am using CI4, so i know that with the query builder, the sql injections are prevented because it escapes automatically.

Regarding escaping in the views:
1) Every thing that is echoed needs to be escaped? using just the esc() function with the first parameter is enough? I read that if you want to escape a url, the second parameter is 'url', but i tried to escape a href with esc(base_url(..../...),'url') and when i click on that button, it doesnt redirect me to the correct page.

2) If i want to be "security cleaned" when they are submitting some form to a DB, and i do it through an ajax call, do i need to do something before calling the controller method? In the controller, i should escape/filter the variables? In the model i am using the query builder class.

3)Any other good tip is accepted. Thanks!!