The image showing an example code for Injection attack II contains an errornous variable name.
In the first call to subprocess.call() the variable file_path is used. But this variable is never defined, in all other lines fpath is used instead.
To conclude, the single occurence of file_path should be replaced by fpath.