According to RFC 3986, section 3.2.1, it needs to be percent encoded:
userinfo = *( unreserved / pct-encoded / sub-delims / ":" )
So it looks like
http://david%40company.com@foo.com/path/
Is right. Where are you trying to read it? Maybe you need to manually decode the value?