If your code accepts URIs as input, filter out “file://”
Wrong way around: only allow <a href="http://" rel="nofollow">http://</a> and <a href="https://" rel="nofollow">https://</a> (and generally filtering out anything thats not letters, numbers, slash or dot is probably a good idea. Remove any sequences of more than one slash or dot.