<body onunload="window.open('esci.php?username=$username &loggato=$loggato');">

senza i backslash