Are there any standard practices for protecting against malicious links being entered in a public form?

Question

A website I'm working on needs to have a form for any visitor to submit a request for information about a service. The user will not need to create an account, and contact details are just part of the form. The user can also enter a free form message. This information is to be forwarded to someone non-technical who will contact them about buying services. (So yes, this is pretty much marketing stuff.)

My concern is that the user could enter something malicious. Obviously, I can do some things to mitigate if they try to enter HTML or JavaScript (e.g., escaping the content), but what if they just enter a URL? Some e-mail clients (e.g., Outlook) automatically convert URLs into clickable links even if the e-mail was sent as plain text. Is there any standard technical practice I can implement to protect the recipient of this info from blindly clicking it and winding up on a malicious site? Or do I have to rely on the user's Junk Mail filter and judgement (possibly augmented with training)?

A point of clarification: this app is being built as contract work, so we have pretty much no control over the e-mail systems of the people who would receive these requests.

Answer 1

Before the email is sent, you can grab all URLs with a regexp, and then submit them to Googles Safe Browsing API to check if they are known to be malicious. If so, just don't send the email or include a warning.