bluej,
For .htaccess password protecting directories, if you are unable to do it via cpanel you'll have to manually do it. Just make a simple google search, you'll get it.
About db backup files - when you connect to FTP, the top folder you'll see would probably be public_html or htdocs or httpdocs or html. Always save your backups above THIS top folder. Simple as that.