diff --git a/src/wp-admin/options-permalink.php b/src/wp-admin/options-permalink.php
index a22cdb0c92f62..11b07ec15e767 100644
--- a/src/wp-admin/options-permalink.php
+++ b/src/wp-admin/options-permalink.php
@@ -126,21 +126,15 @@
 	}
 
 	if ( isset( $_POST['category_base'] ) ) {
-		$category_base = $_POST['category_base'];
-
-		if ( ! empty( $category_base ) ) {
-			$category_base = $blog_prefix . preg_replace( '#/+#', '/', '/' . str_replace( '#', '', $category_base ) );
-		}
+		$category_base = ltrim( $_POST['category_base'], '/' );
+		$category_base = empty( $category_base ) ? '' : $blog_prefix . '/' . implode( '/', array_map( 'sanitize_title_with_dashes', preg_split( '|/+|', $category_base ) ) );
 
 		$wp_rewrite->set_category_base( $category_base );
 	}
 
 	if ( isset( $_POST['tag_base'] ) ) {
-		$tag_base = $_POST['tag_base'];
-
-		if ( ! empty( $tag_base ) ) {
-			$tag_base = $blog_prefix . preg_replace( '#/+#', '/', '/' . str_replace( '#', '', $tag_base ) );
-		}
+		$tag_base = ltrim( $_POST['tag_base'], '/' );
+		$tag_base = empty( $tag_base ) ? '' : $blog_prefix . '/' . implode( '/', array_map( 'sanitize_title_with_dashes', preg_split( '|/+|', $tag_base ) ) );
 
 		$wp_rewrite->set_tag_base( $tag_base );
 	}
diff --git a/tests/phpunit/tests/admin/optionsPermalink.php b/tests/phpunit/tests/admin/optionsPermalink.php
new file mode 100644
index 0000000000000..58db8838d8fde
--- /dev/null
+++ b/tests/phpunit/tests/admin/optionsPermalink.php
@@ -0,0 +1,36 @@
+<?php
+
+/**
+ * Tests for wp-admin/options-permalink.php
+ *
+ * @group admin
+ * @group rewrite
+ */
+class Tests_Admin_OptionsPermalink extends WP_UnitTestCase {
+	/**
+	 * Data provider for base sanitization tests.
+	 */
+	public function data_base_sanitization() {
+		return array(
+			array( 'Foo Bar', '/foo-bar' ),
+			array( 'Foo & Bar!', '/foo-bar' ),
+			array( 'Foo Bar/Baz Qux', '/foo-bar/baz-qux' ),
+			array( '', '' ),
+			array( '/Foo Bar', '/foo-bar' ),
+			array( 'Multiple/Slashes', '/multiple/slashes' ),
+		);
+	}
+
+	/**
+	 * Test category and tag base sanitization.
+	 *
+	 * @ticket 16839
+	 * @dataProvider data_base_sanitization
+	 */
+	public function test_base_sanitization( $input, $expected ) {
+		$base   = ltrim( $input, '/' );
+		$result = empty( $base ) ? '' : '/' . implode( '/', array_map( 'sanitize_title_with_dashes', preg_split( '|/+|', $base ) ) );
+
+		$this->assertSame( $expected, $result );
+	}
+}