PSET 8 Finance ":( buy handles valid purchase exception raised in application: TypeError: 'method' object is not subscriptable"

Question

I've been having a problem with CHECK50, I cant seem to find the right object to change. This is the log I get sending GET request to /signin sending POST request to /login sending POST request to /buy exception raised in application: TypeError: 'method' object is not subscriptable

This is my code:

@app.route("/buy", methods=["GET", "POST"])
@login_required
def buy():
    """Buy shares of stock"""
    if request.method == "GET":
        return render_template("buy.html")
        
# check for errors
    else:
        symbol = request.form.get("symbol")
        if not symbol:
            return (apology("Invalid TXT"))
        shares = request.form.get("shares")
        if not shares or not shares.isnumeric():
            return (apology("Invalid Shares"))
        shares = int(shares)
        results = lookup(symbol)
        if not results:
            return apology("Symbol not found")
        cashlookup = db.execute("select cash from users where id={}".format(session["user_id"]))
        cash = cashlookup[0]["cash"]
        if results["price"]*shares > cash:
            return (apology("Not enough money"))
        cash -= results["price"]*shares
        db.execute("update users set cash = {}  where id = {}".format(cash, session["user_id"]))
        rows = db.execute("insert into History (user_id, symbol, price, shares, type, date) values ({}, '{}', {}, {}, '{}', datetime('now'))".format(
            session["user_id"], symbol, results["price"], shares, "B"))
        # flash
        flash("Bought!")
        return redirect("/")

HTML Template for buy

{% extends "layout.html" %}

{% block title %}
    Buy
{% endblock %}

{% block main %}
    <form action="/buy" method="post">
        <div class="form-group">
            <input autocomplete="off" autofocus class="form-control" name="symbol" placeholder="TXT Symbol" type="text">
        </div>
         <div class="form-group">
            <input autocomplete="off" autofocus class="form-control" name="shares" placeholder="Shares" type="text">
        </div>
        <button class="btn btn-primary" type="submit">Submit</button>
    </form>
{% endblock %}

Helpers.py

# Money function


def usd(value):
    """Format value as USD."""
    return f"${value:,.2f}"
    
# total shares function


def totalshares(symbol, user_id, db):
    buy_result = db.execute
    ("select sum (shares) as shares from History where user_id = {} and symbol = '{}' and type = 'B' group by symbol".format(user_id, symbol))
    if buy_result:
        bought_shares = buy_result[0].get("shares", 0)
    else:
        bought_shares = 0
    sell_result = db.execute(
        "select sum (shares) as shares from History where user_id = {} and symbol = '{}' and type = 'S' group by symbol".format(user_id, symbol))
    if sell_result:
        sold_shares = sell_result[0].get("shares", 0)
    else:
        sold_shares = 0
    return bought_shares-sold_shares

Thank you guys!

Answer 1

This is two valid python statements in helpers.py (because of the line feed between them):

buy_result = db.execute
("select sum (shares) as shares from History where user_id = {} and symbol = '{}' and type = 'B' group by symbol".format(user_id, symbol))

The first sets buy_result to the execute method, with no query argument. The second is a string.

This if buy_result: always evaluates to true, thus the "'method' object is not subscriptable" error on the next line.

This code is exposed to SQL injection attack because it does not use parametrized queries.