The DataList.EditItemIndex property is zero based.

This control can be used to display user input, which might include malicious client script. Check any information that is sent from a client for executable script, SQL statements, or other code before displaying it in your application. You can use validation controls to verify user input before displaying the input text in a control. ASP.NET provides an input request validation feature to block script and HTML in user input. For more information, see Securing Standard Controls, How to: Protect Against Script Exploits in a Web Application by Applying HTML Encoding to Strings, and Introduction to Validating User Input in ASP.NET Web Pages.