Sure you can use javascrit. The idea is that the email address is composed clientside when the client executes the javascript. Since email spiders don't have javascript implemented, they wont get the emails.
If you want to do it serverside, you can check the $HTTP_USER_AGENT, for example like this:
if (preg_match ("/EmailWolf|EmailCollector|EmailSiphon|ExtractorPro|Mozilla.*NEWT|CherryPicker|Crescent|WebBandit|NICErsPRO/i",$HTTP_USER_AGENT)) {...}
The problem is that often the email spiders set's fake $HTTP_USER_AGENT, so that you really don't know if it is a spieder or a browser....