@app.route("/buy", methods=["GET", "POST"])
@login_required
def buy():
    if request.method == "POST":
        if not request.form.get("symbol"):
            return apology("Please enter the symbol of the stock you want to purchase")

        elif not request.form.get("share"):
            return apology("You need to enter number of shares you want to purchase")

        else:
            stock = request.form.get("symbol")
            shares = int(request.form.get("share"))

        purchase = lookup(stock)

        if not purchase:
            return apology("You need to enter a valid stock symbol. Please check again.")

        row = db.execute("SELECT cash FROM users WHERE id = :id", id = session["user_id"])
        total = purchase["price"] * shares
        money = row[0]["cash"]

        if total  > money:
            return apology("You don't have enough money to do that.")
        else:
            order = db.execute("UPDATE users SET cash = cash - 'total' WHERE id = :id", id = session["user_id"])
            return order
    # else if user reached route via GET (as by clicking a link or via redirect)
    else:
        return render_template("buy.html")