You can get this work like you want exactly as you were doing it. I do this all the time.
If you were using zsh and a terminal that brackets its pastes with special escape sequences like urxvt, it would've already worked as you wanted by default. If you're using bash, you just need to activate its interpretation of paste brackets by doing bind 'set enable-bracketed-paste on'
. It'll then wait for you to hit Enter before executing what you pasted. In this regard, the difference between bash and zsh is that bash will separate the commands you pasted in history, such that for 2 lines you'd need to hit Up, Up, Enter, Up, Up, Enter, while zsh keeps the commands pasted grouped as one in the history no matter how many lines, Up, Enter.
There's more of this written in the following answers. Second one's mine and includes a table of terminals that support bracketed-paste. If you do end up using urxvt, I recommend installing the extension I included in the answer to avoid the vulnerability that the question was about:
https://security.stackexchange.com/a/52655/132634
https://security.stackexchange.com/a/184112/132634
EDIT: By the way, just to be more explicit in case you missed it, if you're not doing this (using bracketed-paste), you're open to shell code injection when you're pasting from websites. Websites can, after all, hide code in all sorts of ways and have you copy it without your knowledge.
Check this site, to see if you're vulnerable:
http://thejh.net/misc/website-terminal-copy-paste
It looks like you'd be executing:
git clone git://git.kernel.org/pub/scm/utils/kup/kup.git
when in reality, you'd be running something like this (I removed a non-printable escape byte):
git clone [201~/dev/null; clear; echo -n "Hello ";whoami|tr -d '\n';echo -e '!\nThat was a bad idea. Don'"'"'t copy code from websites you don'"'"'t trust!
Here'"'"'s the first line of your /etc/passwd: ';head -n1 /etc/passwd
git clone git://git.kernel.org/pub/scm/utils/kup/kup.git