User-821857111 posted
SqlParameter[] param = new SqlParameter[0];
param[0] = new SqlParameter("@ID", SqlDbType.Char, 10);
param[0].Value = ID;
param[1] = new SqlParameter("@PWD", SqlDbType.Char, 10);
param[1].Value = PWD;
You declared an array of zero size then tried to set values of elements that don't exist in the array. Change the declaration:
SqlParameter[] param = new SqlParameter[2];