Делаю запрос на получение данных из базы, но в ответ получаю содержание подключенного к контролеру require (login.html)

window.onload = function(){
    var title = document.getElementById('title');
    var text_box = document.getElementById('text_box');
    alert("Download");
    ajaxShow();
    document.querySelector('#create').onclick = function (){
        ajaxCreate();
    }
    document.querySelector('#save').onclick = function(){
        var params ='title=' + title.value +'&'+'text_box='+text_box.value;
        ajaxSave(params);
    }
}
function ajaxShow(){
    var req = new XMLHttpRequest();
    req.onreadystatechange = function(){
        if(req.readyState==4 && req.status==200){
            var div = document.querySelector('div');
            var postText = req.responseText;
            console.log(postText);
            var postList = JSON.parse(postText);
            for (var i = 0; i < postList.length; i++) {
                var row = postList[i];           
                var title_box = document.createElement("INPUT");
                var text_box = document.createElement("INPUT");
                var edit_button = document.createElement("INPUT");
                var delete_button = document.createElement("INPUT");
                title_box.setAttribute("style","width:100px;height:20px;margin-top:10px");
                title_box.setAttribute("type","text");
                title_box.setAttribute("name","title+'row['id']'");
                title_box.setAttribute("value",row["title"]);
                title_box.setAttribute("disabled","");
                text_box.setAttribute("style","width:300px;height:60px;margin-top:10px");
                text_box.setAttribute("type","text");
                text_box.setAttribute("name","text_box"+row['id']);
                text_box.setAttribute("value",row["text"]);
                text_box.setAttribute("disabled","");
                edit_button.setAttribute("type","button");
                edit_button.setAttribute("value","Редактировать");
                edit_button.setAttribute("style","width:100px;height:20px;margin-top:10px");
                delete_button.setAttribute("type","button");
                delete_button.setAttribute("value","Удалить");
                delete_button.setAttribute("style","width:100px;height:20px;margin-top:10px;margin-left:20px");
                div.appendChild(title_box);
                div.appendChild(text_box);
                div.appendChild(delete_button);
                div.appendChild(edit_button);                
            };

            }
        }
    req.open('GET','Note.php',true);    
    req.setRequestHeader('Content-Type','application/x-www-form-urlencoded');
    req.send();
}
function ajaxCreate(){
    var xhr =  new XMLHttpRequest();
    xhr.onreadystatechange = function(){
        if(xhr.readyState==4 && xhr.status==200){
            document.querySelector('#save_post').style.display='block';
        }
    }
    xhr.open('POST','login.php');
    xhr.setRequestHeader('Content-Type','application/x-www-form-urlencoded');
    xhr.send();
}
function ajaxSave(params){
    var req = new XMLHttpRequest();
    req.onreadystatechange = function(){
        if(req.readyState==4 && req.status==200){
            document.querySelector('#save_post').style.display='none';
            var div = document.querySelector('div');
            var title = document.getElementById('title');
            var text = document.getElementById('text_box');
            var title_box = document.createElement("INPUT");
            var text_box = document.createElement("INPUT");
            title_box.setAttribute("style","width:100px;height:20px;margin-top:10px");
            title_box.setAttribute("type","text");
            title_box.setAttribute("value",title.value);
            title_box.setAttribute("disabled","");
            text_box.setAttribute("style","width:300px;height:60px;margin-top:10px");
            text_box.setAttribute("type","text");
            text_box.setAttribute("value",text.value);
            text_box.setAttribute("disabled","");
            div.appendChild(title_box);
            div.appendChild(text_box);
            title.value = '';
            text.value = '';
        }
    }
    req.open('POST','SaveNotes.php',true);    
    req.setRequestHeader('Content-Type','application/x-www-form-urlencoded');
    req.send(params);
}
<?php
require_once ROOT.'/components/db.php';
class Note{
    public static function showNotes(){
        $db = Db::getConnection();
        $result =$db->prepare("SELECT * FROM posts") ;
        $result->setFetchMode(PDO::FETCH_ASSOC);
        $result->execute();
        $i=0;
        while($row = $result->fetch()){
            $postList[$i]['id']=$row['id'];
            $postList[$i]['title']=$row['title'];
            $postList[$i]['text']=$row['text'];
            $i++;
        }
        $json = json_encode($postList);
        return ($json);
    }

}