A couple of people commented above that the address could still be harvested but the best approach I’ve found is to use disposable addresses that you publish on the site and get them to forward to another address that a user actually checks – this way when one becomes over-spammed then you can just delete the address (as it is being used for junk) and move onto the next. Personally, my preference is to forgo e-mail links on sites and use contact forms instead but sometimes clients insist.

This post was more about code than it was about security.

I just wanted to warn that email addresses obfuscated in this way (any kind of encoding or using javascript to encode or create the mail-to link) are still picked up by spammers. I’ve tested this myself and the addresses were ‘found’ by spam bots. Recently this has expanded to addresses written like so: name[at]example[dot]com. At this point I have been forced to switch to images of email addresses and avoid the mailto links altogether. That or I create a contact web form instead. *sigh*