You might have noticed that I've added a commented noscript-part for JavaScript-less browsers. The noscript part would only display the mail address in a form like user{at}domain.com. Other forms can be done easily. In the war against spam we sometimes have to make compromises.

I dislike the use of JavaScript for important things (navigation et al.). IMHO, a website needs to be functional without JS. On the other side all modern browsers are capable of JavaScript but the harvesters are not.

For the deep water: yes, you might be right, but as I have control over the html code, I might catch every mailto. Or I might miss one and expose an address to a spammer. I can live with this. Your regex won't help, as it catches less then mine. Furtheron I would not be able to use the javascript replacement.

I have an alternative implementation using HTML::TokeParser. This should avoid deep water but performs worse that that regex. Another compromise.

Anyway, many thanks for your remarks. This code is just a suggestion, I don't force anybody to use it. Besides the JS thing, do you think it's badly implemented?