You need to indent your code and quote your string indices correctly, e.g.,
function buy($city, $sec, $id, $player) {
global $biz; // loads business information
global $stats_array; // loads user information
global $prefix;
$countlimit = "SELECT COUNT(organization)
FROM city_fronts WHERE organization='$stats_array[family]'";
if ($stats_array['cash'] < $biz['value']) {
echo "You do not have enough cash to purchase this business. You need a total of $"
. number_format($biz[value]);
}
elseif ($biz['owner'] != '') {
echo "This business is no longer for sale.";
}
elseif ($stats_array['family'] == '') {
echo "You must be in a family before you can buy a property.";
}
elseif ($countlimit > $max_famprop) {
echo "Families are only allowed to control 2 cities worth of businesses.";
}
else {
echo "True";
}
}
Now, I notice that $countlimit is a string. This string appears to be an SQL statement, but you never actually executed the SQL statement. $max_famprop appears to be undefined.
By the way, avoid global variables as they can lead to tight coupling: you would find it difficult to rename $stats_array, for example.