By looking at the code, I assume that the user is entering the URL parameter into a form.
As @SilverlightFox said, an attacker could enter
But since XSS is a complicated topic, and I do not have insight in the whole application code, I would still make some precautions.
Also, if possible, limit the URLs that can be entered to your domain only. If a user can enter other domains, issue a warning that they are leaving your site.
If you are inserting the url parameter anywhere else in the code, make sure to use the proper output encoding.