Something

<?php
$str = '<script type="text/javascript">alert(\'lawl!!\')</script><a href="javascript:alert(\'lawl again!!!\')">=D</a>';
$str = htmlspecialchars($str);

$str = preg_replace('#&lt;a href\="(.+?)"&gt;(.+?)&lt;/a&gt;#ie', 'do_url($1, $2)', $str);

function do_url($url, $name)
{
	if(strpos($url,'http://') !== 0 || strpos($url,'ftp://') !== 0)
		return '&lt;a href="'.$url.'"&gt;'.$name.'&lt;/a&gt;';
	else
		return '<a href="'.$url.'">'.$name.'</a>';
}
?>