You are doing it wrong, to assign a value to an SQL Query parameter you'll need to do it this way:
command = new OdbcCommand("select id, username, password from users where username=@param1", connection);
The same thing for these lines as well:
OdbcCommand command1 = new OdbcCommand("update users set username=@username,password=@username where username=@username2", connection);
You first define a parameter name inside the query after the "@" symbol then you can apply any value to that parameter using :
I believe that's the reason why you are getting the Null Reference Exception, as the internal Method (Add) cannot find the parameter that you've given it, and mostly if you Check your debugger's Internal Exception at that point, you might find something related to your parameter, such as "Parameter "name" not found...etc".
hope that helps.