Mastering SQL programming skills is fundamental in computer science education, and Online Judging Systems (OJS) play a critical role in automatically assessing SQL codes, improving the accuracy and efficiency of evaluations. However, these systems are vulnerable to manipulation by students who can submit "cheating codes" that pass the tests without genuinely solving programming problems or demonstrating authentic SQL skills. This study analyzed over 5.8 million SQL codes validated by OJS and identified four types of cheating codes: Explicit Result Output, Quantitative Output Manipulation, Data-Observed Clause Manipulation, and DML-Driven Test Case Distortion. The initial experiment treated SQL codes as plain text using the Bag of Words vector model and processed them with six machine learning models to detect cheating. The results showed an average recall of 74.73% and precision of 97.10%, confirming the efficacy of automated detection. In the subsequent experiments, the first of these used 12 syntactic and semantic features of SQL codes, achieving a recall rate of 59.55% and precision of 87.26%. The final experiment added two more characteristic features of cheating codes to these models, significantly improving recall to 89.35% and precision to 95.25%. This highlights the importance of characteristic cheating features in identifying cheating codes. The study's findings deepen our understanding of cheating codes and contribute to enhancing online programming education and assessment quality.