Index: wp-admin/custom-background.php
===================================================================
--- wp-admin/custom-background.php	(revision 27691)
+++ wp-admin/custom-background.php	(working copy)
@@ -159,13 +159,10 @@
 			set_theme_mod('background_attachment', $attachment);
 		}
 
-		if ( isset($_POST['background-color']) ) {
+		if ( isset( $_POST['background-color'] ) ) {
 			check_admin_referer('custom-background');
-			$color = preg_replace('/[^0-9a-fA-F]/', '', $_POST['background-color']);
-			if ( strlen($color) == 6 || strlen($color) == 3 )
-				set_theme_mod('background_color', $color);
-			else
-				set_theme_mod('background_color', '');
+			$color = sanitize_hex_color_no_hash( $_POST['background-color'] );
+			set_theme_mod( 'background_color', $color ) ;
 		}
 
 		$this->updated = true;
Index: wp-admin/custom-header.php
===================================================================
--- wp-admin/custom-header.php	(revision 27691)
+++ wp-admin/custom-header.php	(working copy)
@@ -225,12 +225,12 @@
 			set_theme_mod( 'header_textcolor', 'blank' );
 		} elseif ( isset( $_POST['text-color'] ) ) {
 			check_admin_referer( 'custom-header-options', '_wpnonce-custom-header-options' );
-			$_POST['text-color'] = str_replace( '#', '', $_POST['text-color'] );
-			$color = preg_replace('/[^0-9a-fA-F]/', '', $_POST['text-color']);
-			if ( strlen($color) == 6 || strlen($color) == 3 )
+			$color = sanitize_hex_color_no_hash( $_POST['text-color'] );
+			if ( ( $color !== '' ) && ( $color !== null ) ) {
 				set_theme_mod('header_textcolor', $color);
-			elseif ( ! $color )
+			} else {
 				set_theme_mod( 'header_textcolor', 'blank' );
+			}
 		}
 
 		if ( isset( $_POST['default-header'] ) ) {
Index: wp-includes/class-wp-customize-manager.php
===================================================================
--- wp-includes/class-wp-customize-manager.php	(revision 27691)
+++ wp-includes/class-wp-customize-manager.php	(working copy)
@@ -1083,68 +1083,4 @@
 
 		return $color;
 	}
-};
-
-/**
- * Sanitizes a hex color.
- *
- * Returns either '', a 3 or 6 digit hex color (with #), or null.
- * For sanitizing values without a #, see sanitize_hex_color_no_hash().
- *
- * @since 3.4.0
- *
- * @param string $color
- * @return string|null
- */
-function sanitize_hex_color( $color ) {
-	if ( '' === $color )
-		return '';
-
-	// 3 or 6 hex digits, or the empty string.
-	if ( preg_match('|^#([A-Fa-f0-9]{3}){1,2}$|', $color ) )
-		return $color;
-
-	return null;
-}
-
-/**
- * Sanitizes a hex color without a hash. Use sanitize_hex_color() when possible.
- *
- * Saving hex colors without a hash puts the burden of adding the hash on the
- * UI, which makes it difficult to use or upgrade to other color types such as
- * rgba, hsl, rgb, and html color names.
- *
- * Returns either '', a 3 or 6 digit hex color (without a #), or null.
- *
- * @since 3.4.0
- * @uses sanitize_hex_color()
- *
- * @param string $color
- * @return string|null
- */
-function sanitize_hex_color_no_hash( $color ) {
-	$color = ltrim( $color, '#' );
-
-	if ( '' === $color )
-		return '';
-
-	return sanitize_hex_color( '#' . $color ) ? $color : null;
-}
-
-/**
- * Ensures that any hex color is properly hashed.
- * Otherwise, returns value untouched.
- *
- * This method should only be necessary if using sanitize_hex_color_no_hash().
- *
- * @since 3.4.0
- *
- * @param string $color
- * @return string
- */
-function maybe_hash_hex_color( $color ) {
-	if ( $unhashed = sanitize_hex_color_no_hash( $color ) )
-		return '#' . $unhashed;
-
-	return $color;
-}
+};
\ No newline at end of file
Index: wp-includes/formatting.php
===================================================================
--- wp-includes/formatting.php	(revision 27691)
+++ wp-includes/formatting.php	(working copy)
@@ -3825,3 +3825,67 @@
 
 	return false;
 }
+
+/**
+ * Sanitizes a hex color.
+ *
+ * Returns either '', a 3 or 6 digit hex color (with #), or null.
+ * For sanitizing values without a #, see sanitize_hex_color_no_hash().
+ *
+ * @since 3.4.0
+ *
+ * @param string $color
+ * @return string|null
+ */
+function sanitize_hex_color( $color ) {
+	if ( '' === $color )
+		return '';
+
+	// 3 or 6 hex digits, or the empty string.
+	if ( preg_match('|^#([A-Fa-f0-9]{3}){1,2}$|', $color ) )
+		return $color;
+
+	return null;
+}
+
+/**
+ * Sanitizes a hex color without a hash. Use sanitize_hex_color() when possible.
+ *
+ * Saving hex colors without a hash puts the burden of adding the hash on the
+ * UI, which makes it difficult to use or upgrade to other color types such as
+ * rgba, hsl, rgb, and html color names.
+ *
+ * Returns either '', a 3 or 6 digit hex color (without a #), or null.
+ *
+ * @since 3.4.0
+ * @uses sanitize_hex_color()
+ *
+ * @param string $color
+ * @return string|null
+ */
+function sanitize_hex_color_no_hash( $color ) {
+	$color = ltrim( $color, '#' );
+
+	if ( '' === $color )
+		return '';
+
+	return sanitize_hex_color( '#' . $color ) ? $color : null;
+}
+
+/**
+ * Ensures that any hex color is properly hashed.
+ * Otherwise, returns value untouched.
+ *
+ * This method should only be necessary if using sanitize_hex_color_no_hash().
+ *
+ * @since 3.4.0
+ *
+ * @param string $color
+ * @return string
+ */
+function maybe_hash_hex_color( $color ) {
+	if ( $unhashed = sanitize_hex_color_no_hash( $color ) )
+		return '#' . $unhashed;
+
+	return $color;
+}
\ No newline at end of file