Please fix the following implementation of /buy for a stock trading site. Here’s app.py:
import os


from cs50 import SQL
from flask import Flask, flash, redirect, render_template, request, session
from flask_session import Session
from werkzeug.security import check_password_hash, generate_password_hash

from helpers import apology, login_required, lookup, usd

# Configure application
app = Flask(__name__)

# Custom filter
app.jinja_env.filters["usd"] = usd

# Configure session to use filesystem (instead of signed cookies)
app.config["SESSION_PERMANENT"] = False
app.config["SESSION_TYPE"] = "filesystem"
Session(app)

# Configure CS50 Library to use SQLite database
db = SQL("sqlite:///finance.db")


@app.after_request
def after_request(response):
    """Ensure responses aren't cached"""
    response.headers["Cache-Control"] = "no-cache, no-store, must-revalidate"
    response.headers["Expires"] = 0
    response.headers["Pragma"] = "no-cache"
    return response


@app.route("/")
@login_required
def index():
    # Assume db.execute() returns a dict or a list of dicts
        user_cash = db.execute("SELECT cash FROM users WHERE id = :id", id=session['user_id'])[0]['cash']
        purchases = db.execute("""
            SELECT symbol, SUM(shares) as shares, AVG(price) as price
            FROM purchases WHERE user_id = :id
            GROUP BY symbol
            HAVING SUM(shares) > 0;
            """, id=session['user_id'])
    # Fixed indent of for loop and calculate total
        for purchase in purchases:
            purchase['total'] = purchase['shares'] * purchase['price']


    # Moved the summation of total_assets out of the for loop
        total_assets = sum(purchase['total'] for purchase in purchases) + user_cash

        return render_template("index.html", cash=user_cash, purchases=purchases, total_assets=total_assets)




@app.route("/buy", methods=["GET", "POST"])
@login_required
def buy():
    if request.method == "GET":
        return render_template("buy.html")
    elif request.method == "POST":
        my_symbb = request.form.get('symbolb')
        my_quant = request.form.get('quantity')

        try:
            my_quant = int(my_quant)
            if my_quant <= 0:
                return apology("more than 0, idiot", 400)

            db.execute("INSERT INTO purchases (symbol, shares, price) VALUES (:symbol, :shares, 12)", symbol=my_symbb, shares=my_quant)

            # Handle success or add a redirection here
            return render_template("success.html")  # Assuming there is a success.html template

        except ValueError:
            return apology("invalid quantity", 400)
        except Exception as e:
            return apology("An error occurred: " + str(e), 400)


@app.route("/history")
@login_required
def history():
    """Show history of transactions"""
    return apology("TODO")


@app.route("/login", methods=["GET", "POST"])
def login():
    """Log user in"""

    # Forget any user_id
    session.clear()

    # User reached route via POST (as by submitting a form via POST)
    if request.method == "POST":

        # Ensure username was submitted
        if not request.form.get("username"):
            return apology("must provide username", 403)

        # Ensure password was submitted
        elif not request.form.get("password"):
            return apology("must provide password", 403)

        # Query database for username
        rows = db.execute("SELECT * FROM users WHERE username = ?", request.form.get("username"))

        # Ensure username exists and password is correct
        if len(rows) != 1 or not check_password_hash(rows[0]["hash"], request.form.get("password")):
            return apology("invalid username and/or password", 403)

        # Remember which user has logged in
        session["user_id"] = rows[0]["id"]

        # Redirect user to home page
        return redirect("/")

    # User reached route via GET (as by clicking a link or via redirect)
    else:
        return render_template("login.html")


@app.route("/logout")
def logout():
    """Log user out"""

    # Forget any user_id
    session.clear()

    # Redirect user to login form
    return redirect("/")


@app.route("/quote", methods=["GET", "POST"])
@login_required
def quote():
    """Get stock quote."""
    if request.method == "GET":
        return render_template("quote.html")
    elif request.method == "POST":
        my_symbol = request.form.get('symbol')
        if not my_symbol:
            flash("symbol is required", "error")
            return redirect("/quote")
        stock = lookup(my_symbol)
        if stock:
            return render_template("quoted.html", stock=stock)
        else:
            flash("Could not retrive stock info", "error")
            return redirect("/quote")
    else:
        flash("Invalid reuqest method", "error")
        return redirect("/quote")









@app.route("/quoted", methods=["GET", "POST"])
@login_required
def quoted():
    if request.method == "POST":
        return render_template("quoted.html", stock)
    if request.method == "GET":
        return render_template("quoted.html", stock)




@app.route("/register", methods=["GET", "POST"])
def register():

    # Forget any user_id
    session.clear()

    # User reached route via POST (as by submitting a form via POST)
    if request.method == "POST":

        # Ensure username was submitted
        if not request.form.get("username"):
            return apology("must provide username", 403)

        # Ensure password was submitted
        elif not request.form.get("password"):
            return apology("must provide password", 403)

        # Query database for username
        username = request.form.get("username")
        rows = db.execute("SELECT * FROM users WHERE username = :username", username=username)  # :username is a named placeholder
        if rows:
            return apology("username already exists", 403)

          # Hash user's password
        hashed_password = generate_password_hash(request.form.get("password"))

                # Insert new user into the database
        db.execute("INSERT INTO users (username, hash) VALUES (:username, :hash)", username=username, hash=hashed_password)  # :username and :hash are named placeholders


        # Redirect user to login page or some other page
        flash("Registered successfully, please log in.")
        return redirect("/login") # Assuming there is a login view

    else:  # User reached route via GET
        return render_template("register.html") # Assuming there is a 'register.html' template






@app.route("/sell", methods=["GET", "POST"])
@login_required
def sell():
    """Sell shares of stock"""
    return apology("TODO")
Here's buy.html:
{% extends "layout.html" %}


{% block title %}
    Quote
{% endblock %}


{% block main %}
    <form action="/quote" method="post">
        <div class="mb-3">
            <input autocomplete="off" autofocus class="form-control mx-auto w-auto" id="symbolb" name="symbolb" placeholder="Symbol Name" type="text">
        </div>
        <div>
            <input autocomplete="off" class="form-control mx-auto w-auto" id="quantity" name="quantity" placeholder="How many?" type="number">
        </div>
        <div> <br>
        <button type="submit" class="btn btn-primary">Buy</button>
        </div>
    </form>
{% endblock %}

Here's herlpers.py: 
import csv
import datetime
import pytz
import requests
import subprocess
import urllib
import uuid

from flask import redirect, render_template, session
from functools import wraps


def apology(message, code=400):
    """Render message as an apology to user."""
    def escape(s):
        """
        Escape special characters.

        https://github.com/jacebrowning/memegen#special-characters
        """
        for old, new in [("-", "--"), (" ", "-"), ("_", "__"), ("?", "~q"),
                         ("%", "~p"), ("#", "~h"), ("/", "~s"), ("\"", "''")]:
            s = s.replace(old, new)
        return s
    return render_template("apology.html", top=code, bottom=escape(message)), code


def login_required(f):
    """
    Decorate routes to require login.

    http://flask.pocoo.org/docs/0.12/patterns/viewdecorators/
    """
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if session.get("user_id") is None:
            return redirect("/login")
        return f(*args, **kwargs)
    return decorated_function


def lookup(symbol):
    """Look up quote for symbol."""

    # Prepare API request
    symbol = symbol.upper()
    end = datetime.datetime.now(pytz.timezone("US/Eastern"))
    start = end - datetime.timedelta(days=7)

    # Yahoo Finance API
    url = (
        f"https://query1.finance.yahoo.com/v7/finance/download/{urllib.parse.quote_plus(symbol)}"
        f"?period1={int(start.timestamp())}"
        f"&period2={int(end.timestamp())}"
        f"&interval=1d&events=history&includeAdjustedClose=true"
    )

    # Query API
    try:
        response = requests.get(url, cookies={"session": str(uuid.uuid4())}, headers={"User-Agent": "python-requests", "Accept": "*/*"})
        response.raise_for_status()

        # CSV header: Date,Open,High,Low,Close,Adj Close,Volume
        quotes = list(csv.DictReader(response.content.decode("utf-8").splitlines()))
        quotes.reverse()
        price = round(float(quotes[0]["Adj Close"]), 2)
        return {
            "name": symbol,
            "price": price,
            "symbol": symbol
        }
    except (requests.RequestException, ValueError, KeyError, IndexError):
        return None


def usd(value):
    """Format value as USD."""
    return f"${value:,.2f}"
And finance.db sqlite3 .schema is: 
finance.db sqlite3 .schema is:
 CREATE TABLE users (id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, username TEXT NOT NULL, hash TEXT NOT NULL, cash NUMERIC NOT NULL DEFAULT 10000.00); CREATE TABLE sqlite_sequence(name,seq); CREATE UNIQUE  INDEX username ON users (username); CREATE TABLE purchases (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL, symbol TEXT NOT NULL, shares INTEGER NOT NULL, price REAL NOT NULL, timestamp DATETIME DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY (user_id) REFERENCES users (id));