This shares = request.form.get("shares") creates shares as a string. -1 * shares returns '', because of the python "string multiplication" feature. Cast it to an int, as has been done here stock_total = price * (int(shares)). (Or cast it to an int when it is first set so the function will always treat it as an int.)
Have you looked at the flask log (in the console where you flask run). I'd expect it to be giving an error hereabouts:
new_user = db.execute("INSERT INTO users ('username', 'hash') VALUES (:username, :new_pass)", username=request.form.get("username"), hash=hashed_pass)
It is expecting a value for the named parameter :new_pass, but the value is supplied ...
INSERT .... ON DUPLICATE KEY UPDATE....
ON DUPLICATE is a clause attached to an insert statement.
For more, google "ON DUPLICATE KEY in sql"
If this answers your question, please click on the check mark to accept. Let's keep up on forum maintenance. ;-)