If you're only trying to convert links, the safest option is to use sanitization and a whitelist. Basically a list of allowed values, which prevents anything you don't specify from being passed. Always use a reputable sanitization function and whitelist, I would not recommend building your own unless you know what you're doing. See a page like the following for reference (make sure all sanitization/validation is happening on the server side, of course):
I think the prospect of making your users use a markup language is a good suggestion for tag injected XSS, but it doesn't really address the issue of URI concat'd XSS.
I find the previous answerer's response of essentially saying that you should only prepare for simple attacks because otherwise you're "going down the rabbit hole" is reckless and naive, why don't we just put a simple lock on bank vaults in that case?