import sqlite3
import hashlib


def check_credentials(username, password):
	"""Verifies credentials for username and password.
	Returns None on success or a string describing the error on failure"""
	
	conn = sqlite3.connect('db/user_task.db')
	cursor = conn.execute("SELECT password from user WHERE username == \'%s\'" % (username))
	data = cursor.fetchall()
	conn.close()

	if len(data) == 0:
		return u"Incorrect username"

	for row in data:
		encoded_password = hashlib.sha1(password.encode('utf-8')).hexdigest()
		if row[0] == encoded_password:
			return None

	return u"Incorrect password"
	
	# An example implementation which uses an ORM could be:
	# u = User.get(username)
	# if u is None:
	#     return u"Username %s is unknown to me." % username
	# if u.password != md5.new(password).hexdigest():
	#     return u"Incorrect password"