"...Only alphanumerics [0-9a-zA-Z], the special characters "$-_.+!*'()," [not including the quotes - ed], and reserved characters used for their reserved purposes may be used unencoded within a URL."
You have to hex encode the @ in the URL: user: myuser password: h@t host: myhost
To url => hex encode unsafe characters => ftp://myuser:h%40t@myhost