title: how to prevent xss of href attribute at the server side?
body: <p>In my website ( server side is c# ) , I let users submit links like this:</p>
  
  <pre><code>&lt;a href="$"&gt;link text&lt;/a&gt;
  </code></pre>
  
  <p>Whatever they input will stay inside the "href" attribute only. i want to prevent XSS through the "href" URL.</p>
  
  <p>Right now i check if it's a valid url the c# object URI.</p>
  
  <p>My questions are:</p>
  
  <ol>
  <li>Is using URI for validate a url is enough to prevent url xss?</li>
  <li>if not, how should i prevent this kind of xss?</li>
  </ol>
  
  <p>For example how can i prevent XSS phishing attack of a valid url as: 
      "<a href="http://xss.rocks/xss.css" rel="nofollow noreferrer">http://xss.rocks/xss.css</a>"</p>