Hi I was wondering if anybody has seen this behavior:

One client came with an infected site, I was reviewing the theme files (PHP standard files) with Sublime and didn’t found anything, but on another editor (even TextEdit on the mac), it showed the hacking (and injection code) at the beginning of the file.

After changing the sintaxis of the file to anything other than php, Sublime showed the compromised text.

This is a normal behavior for the editor?

Thank you
Ed