As with most problems, you have 2 broad categories of solutions: use one that someone came up with already, or create your own.
The problem with creating your own is that the work involved is usually much larger than it initially appears. In this case, you have to do a pretty significant amount of checking:
1) Undesirable HTML tags such as <script>, <embed>, <a>, etc., but possibly allow for something like <span style="color: red;">red text</span>
2) Unescaped HTML reserved characters such as &, <, >, and ".
3) Spam links
4) Character replacements that will result in spam links (such as \/\/ \/\/ \/\/.EXAMPLE.COM, ᎳᎳᎳ.EXAMPLE.COM [that's actually not a "W"!], and etc.)
5) Encoded characters such as X (which will turn into a "W" when the user sees it in the browser) and make sure they're not part of a link
6) ASCII art text
7) Text that refers to a link (go to example dot com!)
8) Spaces or other characters in the link (w w w . example . com)
9) Links to bad sites that are obfuscated
http://x10hosting.com:test@example.com:80 (this would go to example.com)
10) Problems with your software that could allow hackers to compromise your site (such as programming mistakes)
11) Possibly more I didn't think of
Or, you could find software that has already done this for you. I would recommend finding software that has this all taken care of already. I use
http://akismet.com/ which blocks known spam users, known spam comments, and also checks for unknown spam as well.
