best proceed hoop confidence prevaricate xss user entered urls

we have high confidence concentration wish grant users enter urls users see.

this introduces high risk xss hacks - user potentially enter javascript another user ends adult executing. given reason understanding information it's essential never happens.

what best practices traffic this? any confidence whitelist evade settlement alone good enough?

any recommendation traffic redirections ("this couple goes outmost the site" summary warning page before following link, instance)

is there an justification ancillary user entered links during all?

---

clarification:

basically the users wish input:

stack .com

and have cost another user:

<a href="http://stack .com">stack .com</a>

what i unequivocally worry controlling xss hack. i.e. input:

alert('hacked!');

so users link:

<a href="javascript:alert('hacked!');">stack .com</a>

my instance only explain risk - i'm good wakeful javascript urls opposite things, nonetheless permitting quarrel latter competence means govern former.

you'd vacant sites smack pretence - html even worse. know understanding links also know sanitize <iframe>, <img> cunning css references?

i'm operative high confidence sourroundings - unparalleled xss penetrate outcome unequivocally high rubbish us. i'm happy i furnish regex (or glorious suggestions far) bar all i cruise of, nonetheless enough?