This looks like something that needs to be redesigned entirely. The main issue is that you are allowing the contents of the about.html file to be written to via a web request. The user can submit a request will allow them to render arbitrary html.
Can the markup in about.html be templated? If so, then you can escape the fields for the appropriate context (attribute vs. element), but as it stands right now there is not a good way to secure this code.
Edit for clarification:
The issue with the current implementation is that you are trying to let a user write an entire html document. With your solution, the user needs to be able to write some html, but should not be allowed to write malicious html. This is extremely difficult to do correctly. Escaping the html (using htmlspecialchars, in this instance) being a part of the correct solution, but I don't believe it it will work with the current implementation. A much easier solution would be to template out the about.html file, and escape all of the data that the user is passing in. This way none of the markup will be controlled by the user.