Essentially, it encodes the "@" symbol as unescape("%40").
("%40" is simply "@" run through the escape() function, which
we reverse with a call to unescape function, yeilding "@" back again).
It encodes "." as unescape("%2e").
This way, any browser that has javascript enables will properly
print the "@" symbol, whereas a spam-bot that looks at the page
code will see unescape("%40")
// A call toemail('scott at hurring dot com');// Generates this Javascript code<script type='text/javascript'> /* Javascript code to print out spam-proof email address */ a = unescape('%40'); d = unescape('%2e'); lt = unescape('%3c'); gt = unescape('%3e'); document.write(lt+'a title="Email: scott (at) hurring (dot) com" href="mailto:scott'+ a+'hurring'+d+'com"'+gt+'scott (at) hurring (dot) com'+lt+'/a'+gt); </script>// Which the browser displays as: