I have a got doubt, whether buying links in directory sites is legal for google, or will they penalize us?
Directories are generally ok as there is an element of human review. So if the site's bad you won't get included. Pick good directories by looking at all normal metrics such backlinks, domain age, page index, etc.
I don't think they are worth paying for unless they are exceptionally good, and there are very few of them out there. There are plenty of free ones out there to submit to. Check out http://forums.digitalpoint.com/forumdisplay.php?f=65 to find a lot of free directories to submit to.