import html


def create_risk_list(risks, simple=False):
    """
    Turns a risk objects into HTML. if simple=True this becomes a <ul>,
    otherwise it becomes a list of <details> which may be expanded for details.
    """
    if simple:
        table = "<ul>"
        for r in risks:
            table += "<li>{} ({})</li>".format( html.escape(r.name), r.mitigation.name )
        table += "</ul>"
        return table
    else:
        table = "<p>"
        for r in risks:
            table += r.get_report_desc()
        table += '<p>'
        return table