Best way to handle security and avoid XSS with user entered URLs

<a href="http://stackoverflow.com">stackoverflow.com</a>

<a href="alert('hacked!');">stackoverflow.com</a>

/// <summary>
/// returns "safe" URL, stripping anything outside normal charsets for URL
/// </summary>
public static string SanitizeUrl(string url)
{
    return Regex.Replace(url, @"[^-A-Za-z0-9+&@#/%?=~_|!:,.;()]", "");
}