No, that's actually the way BH affiliate links get embedded in the HTML - no quotes around the URL, and it actually is called as Javascript. To check it out, login to the BH affiliate site (https://www.bluehost.com/cgi-bin/partner/), and hit the Affiliate Link Code tab.
Interesting, I never actually looked at the code they provided for the banners. :)
So, in that case, just insert it into the source as I described earlier. Although if you look at the Javascript that it references, it's very simple:
document.write('<a href=http://www.bluehost.com/track/jacklh/CODE11 target=_top><img border=0 src=http://img.bluehost.com/180x150/2.gif></a>');
If I were you I would simply put the code that it writes directly on the page:
<a href=http://www.bluehost.com/track/jacklh/CODE11 target=_top><img border=0 src=http://img.bluehost.com/180x150/2.gif></a>
Again you can see that it doesn't put the attributes in quotes. That's most likely not W3C compliant, so if you're putting this on a page that you wish to be W3C compliant, you'll probably want to put quotes in where they should be. :)