Viewstates suck! They are the bane of my existence as a hacker. I hate them with all that I am. Die VIEWSTATES die!.

In other words, if you don't use viewstates in your ASP applications, you should. They really are a pain in the ass for an attacker to deal with. If MAC is turned on (which it is by default), the viewstate becomes tamper resistant and really limits an attackers ability to inject potentially malicious data.