$data = "'".$data_ref."'"; invalidates your dates for sure, probably everything else too. Instead of passing a date, you're passing an SQL string literal of a date. Just pass the date. That's the whole point of placeholders. Well ok, one major point of placeholders.

You call keys %hdr_field_vars twice, expecting the keys to be returned in the same order both times. I think it actually will do so in this very specific program, but it's a very fragile assumption. You'd do well to avoid that assumption. (Save the result of keys %hdr_field_vars into an array, and iterate over the array.)

DBI might be guessing the type of your data incorrectly. (number instead of string, string instead of number) You might need to tell it the proper type (via bind_param).