AntiXSS: URL sanitization

I have a page where user can enter his company URL and this address will be shown as HTML link on another page.  "Looks simple - take AntiXSS, sanitize and URL encode", you will say, but while testing I found that AntiXSS misses following simple case:
http://test.com/?xss='onclick='alert()'
or even obvious
http://test.com/?xss='onclick='javascript:alert()'
Note, that encoding skips single quote, because according to standarts it is normal for URI
 
Any ideas?
...