Do you really need to pass "username" and "error" into your JS function? Your current code is overwriting it upon assignment.
Seems to me it's fine except for a couple bugs and maybe some formatting. What most JS guys do, of course, is use a library like jQuery instead; all it would do in this instance is save a few keystrokes, for the most part (I will admit typing "document.getElementById" 10 times is rather tedious).
I'll leave it in native JS, however:
function validateUsername() {
'use strict'; // because Crockford
var username, error; //init vars
//assignments
username = document.getElementById("username").value,
error = document.getElementById("usernameErr");
error.innerHTML = "";
//logic
if (username == null || username == "") {
document.getElementById("username").style.borderColor = "red";
error.innerHTML = "Username is required"; //you cannot return twice ... so I removed "return" ;)
} else if (!username.match(/^[0-9a-z]{3,}$/)) {
error.innerHTML = "Username must be three characters long";
} else{
document.getElementById("username").style.removeProperty('border');
}
// we can return the length of error.innerHTML which will be "0" is there's no error. This might affect dependent code.
//alternately, use an if/else to return true/false, 1/0, whatever...
return error.innerHTML.length;
}