That %ship_address handling looks fine, AFAICT.

if the form does not contain data for shipaddr2 then shipaddr2 can contain data from a previous call to the handler.

How exactly did you check? Something like this

   ...
   my $shipaddr2 = $r->param("shipaddr2");
   print STDERR "$shipaddr2\n";
[download]

or just by observing that an unexpected value had made it into the DB table? If it's already the lexical $shipaddr2 containing some previous value (when "shipaddr2" isn't in the form/HTTP request), I'd say the problem is with libapreq2/Apache2::Request. At least it would narrow things down...