sub handler {
   my $r = Apache2::Request->new(shift);
   my %in_cookies = Apache2::Cookie->fetch ($r);
   my $session = $in_cookies{"ID"} && $in_cookies{"ID"}->value;
   
   my $dbh = DBI->connect('DBI:mysql:mydb', 'myuser', 'mypasswd', { Ra
+iseError => 1, AutoCommit => 1, PrintError => 1} ) or die $DBI::errst
+r;
   my $shipaddr1 = $r->param("shipaddr1");
   my $shipaddr2 = $r->param("shipaddr2");
   my %ship_address = (addr1 => $shipaddr1, addr2 => $shipaddr2);
   unless ($dbh->selectrow_array("select count(*) from bill where sess
+ion=?",undef,$session)){ # new entry
      $dbh->do("insert into bill (session) values(?)",undef,$session);
      while ( my ($key,$value) = each %ship_address ) {
         $dbh->do("update bill set ship$key = ? where session = ?", un
+def, $value, $session);
      }
   }
[download]

That %ship_address handling looks fine, AFAICT.

if the form does not contain data for shipaddr2 then shipaddr2 can contain data from a previous call to the handler.

How exactly did you check? Something like this

   ...
   my $shipaddr2 = $r->param("shipaddr2");
   print STDERR "$shipaddr2\n";
[download]

or just by observing that an unexpected value had made it into the DB table? If it's already the lexical $shipaddr2 containing some previous value (when "shipaddr2" isn't in the form/HTTP request), I'd say the problem is with libapreq2/Apache2::Request. At least it would narrow things down...