Sugar provides one option for sugar admins to take the backup of sugar
files using the Admin Control panel.
To perform the task login as admin go to the Admin->Backups
there are two input boxes Directory name and file name.

First create one dir at the server where sugar is installed.
Give ownership of this dir to your webserver user typically the same user who
owned the sugar files.
Let assume sugar is installed at /var/www/html/Sugar folder then create one dir
say backup here
$mkdir backup
Give the ownership to webserver user assuming here it is apache
$ chown apache:apache backup

Now enter this dir name with full path in the input box ie:
Directory: /var/www/html/Sugar/backup

In the Filename input box write the file name with .zip extension, say it sugarBk.zip
Filename:sugarBk.zip
Click the Confirm Settings if everything goes fine then Next button “Run Backup” will
come click this and your sugar backup will be stored at /var/www/html/Sugar/backup
with sugarBk.zip file.

As such there are no condition to create the backup folder inside the html/Sugar
this can be anywhere providing webserver has the read/write permission on this folder.
And this is the preferred way as security point of view.