I have an old copy of Windows XP that I am about to install, it doesn't even have SP1 on it.

I remember hearing that it is very dangerous to take an outdated copy of XP online without protection, that it will become infected within moments without even surfing to a single website, is this true? Should I install antivirus and firewalls before connecting the system online? I remember hearing that sometimes XP needs to install some small updates before installing an SP, is this true, or can I install XP offline, then download SP3 from another PC and install that offline without any problems?

What method would you recommend I do? (Other than slipstreaming)