For all the Drupal sites I run except one, requesting /sites/default/settings.php in the browser results in a blank page, which seems right and proper.
But for one of my sites (on a different host), requesting /sites/default/settings.php actually results in the file's contents being served to the browser.
I have no idea where the trouble might be: is this a Drupal problem? Apache problem? Doesn't seem to be related to file permissions. How can I ensure that a request to settings.php doesn't serve the file?
As a stopgap measure I've added a line in .htaccess that generates a 410 error when settings.php is requested, but I'd really like to know how this is supposed to work...