I get an error in my code: Cannot find table 0. what am I doing wrong?

 OdbcCommand cmd = new OdbcCommand("Select * from User where username=? and password=?", cn);
        DataSet ds = new DataSet();
        //Select the username and password from mysql database in login table

        cmd.Parameters.Add("@username", OdbcType.VarChar);
        cmd.Parameters["@username"].Value = this.Login1.UserName;

        cmd.Parameters.Add("@password", OdbcType.VarChar);
        cmd.Parameters["@password"].Value = this.Login1.Password;
        //use asp login control to check username and password

        //Session["UserID"] = "usrName";
        //set the UserID from the User Table unsure how to add this to the sql syntax above

        OdbcDataReader dr = default(OdbcDataReader);
        // Initialise a reader to read the rows from the login table.  
        // If row exists, the login is successful  

        dr = cmd.ExecuteReader();
        DataTable dt = ds.Tables[0];
        DataRow dp = dt.Rows[0];

        if (dt.Rows.Count != 0)
        {
            Session["UserID"] = Convert.ToString(dp["UserID"]);
            e.Authenticated = true;
            Response.Redirect("UserProfileWall.aspx");
          开发者_开发知识库  // Event Authenticate is true forward to user profile
        }

    }

}

---

Your code creates an empty dataset, then tries to get a table from it.
Since you never put anything in the dataset, you get an error.

You need to use the DataReader that you got back from your query (use the HasRows property).

However, I strongly recommend that you

Use ASP.Net's built-in forms authentication system

instead. It will save you lots of code and is more secure.

---

Put User in brackets: [User] - it is a reserved.

I see you're using MySQL - I think it is double quotes then: "User"

---

Do your parameters need to be in the query the same way?

instead of

"Select * from User where username=? and password=?"

should that be

"Select * from User where username=@username and password=@password", 

Edit: this might be way off, it might be something specific to our internal sqlcommand stuff?