Do it in two stages. First unwrap any URLs that the user has already wrapped in <a ...> ... </a> tags. Then wrap all URLs in <a ...> ... </a> tags.

Alternatively, don't allow your users to put the tags in in the first place! This makes it easier to protect yourself and your users against craziness involving some of the other attributes of the <a> tag, like target, onclick and so on.