PHP - First Login System
Security

You are escaping user input, which prevents SQL injection. It's good enough, but really not the recommended way to do this as it's too error-prone (whenever a project does this, it's basically guaranteed that you can find injections). Use prepared statements instead. It's not only more secure, but also leads to nicer code.

Guard Clauses

You have a lot of nested ifs, which makes it difficult to see what happens when (for example, I have to scroll all the way down to see what happens if it's a GET request). 

If you use guard clauses / return early instead, your code will be much more readable. It might look like this:

if (!isset($_POST['submit'])) {
    header("Location: ../index.php?login=error");
    exit();
}

if (empty($username) || empty($password)) {
    header("Location: ../index.php?login=empty");
    exit();
}

// select the user

if (!$userExists) {
    header("Location: ../index.php?login=error");
    exit();
}

// verify the password

if ($validPassword) {
    header("Location: ../index.php?login=error");
    exit();
}

// set the session, redirect


Now it's very clear what happens when.

Duplication and functions

Following a  header redirect with exit is very good practice. You can make sure that you always do this, simplify the code, and make it easier to modify later by extracting that to it's own function (eg redirectError(Error error)). 

True or false

Something is either true or false. There is no reason to do an else check on true if you already did one on false. 

Note though that some equals checks can be unexpected, so you should always use strong comparison (===) if you don't have a reason not to.